Executive brief
A vulnerability in the Linux kernel's file descriptor handling could allow a local attacker to cause a system crash or instability. The issue occurs when the system duplicates file handles, where a processor's attempt to predict future actions could lead to accessing memory incorrectly. This primarily impacts system availability and could be used to disrupt operations on a shared server.
Technical details
A speculative execution vulnerability exists in the Linux kernel's do_dup2() function within fs/file.c. Although the code performs bounds checking on the file descriptor (fd) against max_fds, CPU branch misprediction can cause the kernel to speculatively execute the fetch of fdt->fd[fd] using an out-of-bounds index. This is a classic Spectre-style gadget where speculative execution bypasses software bounds checks. The fix involves using array_index_nospec() to ensure the index is constrained even during speculative execution paths. This vulnerability could be exploited by a local user to cause a kernel panic or potentially leak sensitive information via side-channel analysis, though the reported impact is primarily denial of service.
Affected products
- Linux Linux Kernel versions up to 6.10.4; 6.6.45; 6.1.104; 5.15.165; 5.10.224; 5.4.282; 4.19.320
Timeline
- 2024-08-01: patched: Initial patch authored by Al Viro
- 2024-08-17: disclosed: CVE-2024-42265 published
- 2024-08-17: advisory
References
- https://git.kernel.org/stable/c/08775b3d6ed117cf4518754ec7300ee42b6a5368
- https://git.kernel.org/stable/c/1171ceccabfd596ca370c5d2cbb47d110c3f2fe1
- https://git.kernel.org/stable/c/3f480493550b6a23d3a65d095d6569d4a7f56a0f
- https://git.kernel.org/stable/c/41a6c31df77bd8e050136b0a200b537da9e1084a
- https://git.kernel.org/stable/c/5db999fff545b924b24c9afd368ef5c17279b176
- https://git.kernel.org/stable/c/8aa37bde1a7b645816cda8b80df4753ecf172bf1
- https://git.kernel.org/stable/c/da72e783afd27d9f487836b2e6738146c0edd149